From 60cf60a58fa4d282ba39e3fb6d5bad24b982cfb7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A1udia?= <claudia@codacy.com>
Date: Tue, 1 Sep 2026 11:47:38 +0100
Subject: [PATCH] Add hard-coded password detection rule for Kotlin

Codacy already ships a custom hard-coded-password rule (variable name
matches password/secret/pwd/key, value is a string literal) for Java,
JavaScript/TypeScript, C#, Scala, and Bash, but not for Kotlin. Kotlin
only had a narrow rule scoped to build.gradle files, so a plain
`val password = "..."` in Kotlin source went undetected.

This adds codacy.kotlin.security.hard-coded-password, mirroring the
existing Java/JS rule shape (same message, metadata, and name regex),
plus multiple-tests fixtures under docs/multiple-tests/codacy-rules-kotlin
following the existing Java/JS fixture convention.

Validated locally against the pinned opengrep v1.26.0 binary (matching
the Dockerfile's OPENGREP_VERSION), go run ./cmd/docgen, go test, and a
full docker build.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 docs/codacy-rules.yaml                        | 23 +++++++++++++++++++
 .../codacy-rules-kotlin/patterns.xml          |  4 ++++
 .../codacy-rules-kotlin/results.xml           |  8 +++++++
 .../codacy-rules-kotlin/src/Program.kt        | 11 +++++++++
 4 files changed, 46 insertions(+)
 create mode 100644 docs/multiple-tests/codacy-rules-kotlin/patterns.xml
 create mode 100644 docs/multiple-tests/codacy-rules-kotlin/results.xml
 create mode 100644 docs/multiple-tests/codacy-rules-kotlin/src/Program.kt

diff --git a/docs/codacy-rules.yaml b/docs/codacy-rules.yaml
index 9c67766..67f9967 100644
--- a/docs/codacy-rules.yaml
+++ b/docs/codacy-rules.yaml
@@ -85,6 +85,29 @@ rules:
         - javascript
       impact: HIGH
       confidence: MEDIUM
+  - id: codacy.kotlin.security.hard-coded-password
+    severity: ERROR
+    languages:
+      - kotlin
+    patterns:
+        - pattern-either:
+          - pattern: 'val $PASSWORD = "$VALUE"'
+          - pattern: 'var $PASSWORD = "$VALUE"'
+          - pattern: 'val $PASSWORD: String = "$VALUE"'
+          - pattern: 'var $PASSWORD: String = "$VALUE"'
+        - metavariable-regex:
+            metavariable: "$PASSWORD"
+            regex: "(?i).*(password|motdepasse|heslo|adgangskode|wachtwoord|salasana|passwort|passord|senha|geslo|clave|losenord|clave|parola|secret|pwd|(api|secret|private|access|aws|ssh|auth|session|encryption|decryption|gcp)[_-]?key).*"
+    message: Hardcoded passwords are a security risk. They can be easily found by attackers and used to gain unauthorized access to the system.
+    metadata:
+      owasp:
+        - A3:2017 Sensitive Data Exposure
+      description: Hardcoded passwords are a security risk.
+      category: security
+      technology:
+        - kotlin
+      impact: HIGH
+      confidence: MEDIUM
   - id: codacy.generic.plsql.empty-strings
     severity: WARNING
     languages:
diff --git a/docs/multiple-tests/codacy-rules-kotlin/patterns.xml b/docs/multiple-tests/codacy-rules-kotlin/patterns.xml
new file mode 100644
index 0000000..9ad9b9b
--- /dev/null
+++ b/docs/multiple-tests/codacy-rules-kotlin/patterns.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<module name="root">
+    <module name="codacy.kotlin.security.hard-coded-password" />
+</module>
diff --git a/docs/multiple-tests/codacy-rules-kotlin/results.xml b/docs/multiple-tests/codacy-rules-kotlin/results.xml
new file mode 100644
index 0000000..708a822
--- /dev/null
+++ b/docs/multiple-tests/codacy-rules-kotlin/results.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<checkstyle version="1.5">
+    <file name="Program.kt">
+        <error source="codacy.kotlin.security.hard-coded-password" line="3" message="Hardcoded passwords are a security risk." severity="error" />
+        <error source="codacy.kotlin.security.hard-coded-password" line="4" message="Hardcoded passwords are a security risk." severity="error" />
+        <error source="codacy.kotlin.security.hard-coded-password" line="5" message="Hardcoded passwords are a security risk." severity="error" />
+    </file>
+</checkstyle>
diff --git a/docs/multiple-tests/codacy-rules-kotlin/src/Program.kt b/docs/multiple-tests/codacy-rules-kotlin/src/Program.kt
new file mode 100644
index 0000000..897fc5a
--- /dev/null
+++ b/docs/multiple-tests/codacy-rules-kotlin/src/Program.kt
@@ -0,0 +1,11 @@
+class Program {
+    fun main() {
+        val password = "password" // Issue: Hardcoded password
+        val apiKey = "api_key" // Issue: Hardcoded API key
+        val apiSecret: String = "api_secret" // Issue: Hardcoded API secret
+
+        println("This is a security risk: $password")
+        println("This is a security risk: $apiKey")
+        println("This is a security risk: $apiSecret")
+    }
+}